PT-2026-80361 · Go · Github.Com/Dslipak/Pdf+2
Published
2026-08-18
·
Updated
2026-08-18
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
(This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated"). The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input:
- Unchecked /Size, /Index, /W, and classic subsection header parameters in cross-reference tables allow crafted values to trigger fatal out-of-memory (OOM) panics.
- Unterminated hexadecimal strings cause an infinite loop in readByte and readHexString.
- Cyclic object references (/First, /Parent, /Kids, /Next) in document outlines cause unbounded recursion leading to uncatchable stack overflow.
- Various malformed constructs trigger runtime panics in NewReader and Page.Content (such as empty graphics state pop 'Q', oversized CMap entries, odd-length UTF-16 strings, and newline buffer underflows).
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Github.Com/Dslipak/Pdf
Github.Com/Ledongthuc/Pdf
Rsc.Io/Pdf